Cart

Common Interface (CI) for descrambling TV channels

Hello everybody! This post describes how Common Interface (CI) works on Joker TV device. Common Interface (CI) is required for descrambling (decrypt) TV channels. Usually operators do the encryption for paid TV content (not free content), and end users have to buy Conditional Access Module (CAM) and smart cards for decryption. Smart card should be inserted into CAM, then the CAM should be inserted into a Common Interface (CI) slot on Joker TV device. Here is a photo below:

Joker TV with inserted CAM module and smart card

Note: Joker TV firmware revision 0x37 or newer and libjokertv version 1.10.2 or newer is recommended to work with Common Interface (CI).

Common Interface (CI) and CAM usage

Joker TV does the Common Interface (CI) and CAM initialization. If it is successful then a green LED near the CI should come on. Then we should use joker-tv console app for RF tuning and configuring CI and CAM. For testing purposes I will use following command:

This command will tune the satellite DVB-S2 transponder 12303MHz 27500H on Eutelsat 36B satellite. This transponder broadcasts encrypted content for largest Russian satellite TV operator “Tricolor TV”. I’m using Neotion DRE Pro CAM and smart card officially ordered from Tricolor TV. If everything is ok you should see decrypted content in the out.ts file. Here is the correct output for the above mentioned command:

As you can see, CAM is successfully configured and has started the decryption.

Man-Machine Interface (MMI)

Man-Machine Interface (MMI) is a control interface to interact with CAM. Joker-tv console app exports MMI interaction to TCP port (by default localhost:7777). You can use simple telnet console app to connect to MMI and some useful information can be obtained through it. Here is an example:

In the above listing I have obtained the available subscriptions that are saved to my smart card. Date ranges specify the period of time that I have been allowed to see paid TV content. CAM is unable to decrypt channels after this period of time if I do not extend my subscriptions.

Analyzing interaction with CAM

Joker-tv app can dump all communications to a file with CAM. Option ‘–cam-pcap cam.pcap’ should be used for this. This file contains all traffic control to/from CAM in PCAP format. We can use the Wireshark application to analyze it. Here is screenshots of Wireshark app after opening cam.pcap:

CAM and Host interaction in Wireshark

I have marked the most important information in red. This command was sent from “Host” to “CAM” and contains command (CA PMT command ID: ok descrambling (0x01) to decrypt TV program number 0x7919. This TV program consists of one Video (TS PID 0x1201) and one Audio (TS PID 0x1202) stream. CAM starts decryption after receiving this command from the host.

Transport Stream (TS) traffic to and from CAM

Now, Joker TV should pass TS through CAM and it will transparently decrypt TS traffic and send it back to the Joker TV. Signals form and timings defined in EN50221 standard in section “A.5.5.4 Signal Description”.

Signal to and from CAM according to EN50221 standard

MCLKI signal is a clock generated by Joker TV. According to EN50221, the clock period is 111 ns which means 9 MHz. Data (TS) transmitted on MDI0-7 lines in parallel. This gives us maximum bitrate on Common Interface (CI):

9 MHz * 8 bit = 72 Mbit/sec

Return channel clock (MCLKO) is generated by the CAM module and actually can be clocked at any frequency. As stated in EN50221 – “There is no specification for delay between MCLKI and MCLKO. In the case of a module providing its own MCLKO, they may not even be the same frequency”. Joker TV Verilog implementation takes this into account and should work with any reasonable MCLKO frequencies.

All these lines are connected to a FPGA inside the Joker TV. For those who want to dig deeper into CI lines traced on Joker TV can check this post about hardware sharing.

CAM collection that I have successfully tested with Joker TV

Conclusion

Joker TV has fully supported Common Interface (CI) but is not limited to this functionality. It can be adopted to CAM’s specific set of features or even implement workarounds for known bugs. Please send me your success stories with descrambling TV channels using Joker TV and CAM. I will also maintain compatibility list of supported CAM’s.